Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity.
\nHowever, User->setupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage.
Version affected: ≤2.5.45
The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.
" } ], "value": "The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts." } ], "title": "MISP: Authentication failure logging suppressed during Redis unavailability", "x_gcve": [ { "extensions": { "bcp-05-x-01": { "ai_annotations": [ { "ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [ { "gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama" } ], "review_status": "review", "scope": "record", "tags": [ "ai-computer-assisted:llm-generated", "ai-computer-assisted:classification" ] } ] }, "bcp-05-x-02": { "x_patch2vuln": { "assumptions": [ "The affected version range is inferred from the tag_version_boundary metadata (v2.5.46 with 189 commits after the fix), suggesting the fix landed before the v2.5.46 release; exact affected version boundaries are not explicitly stated in the patch.", "The CVSS availability impact (VA:L) reflects the loss of the security-logging function rather than a denial of service against the MISP application itself.", "The patch does not indicate whether the Redis throttle was the sole mechanism for auth-failure logging or whether a fallback file-based logger existed; the analysis assumes the Redis-gated path was the primary logging path for auth failures.", "The commit date (2 Sep 2026) is taken at face value from the patch metadata." ], "commit": "a39b25d2f141dde954a2f00feed5c6eb9e3989b5", "confidence": "medium", "credits": [ { "lang": "en", "type": "remediation developer", "value": "iglocska" }, { "lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)" } ], "cvssRationale": "The vulnerability is reachable over the network (AV:N) because MISP is a web application. Attack complexity is High (AC:H) because exploitation requires the Redis instance to be specifically unavailable at the time authentication failures occur; it is not a simple request. No attack target is required (AT:N). No privileges are needed (PR:N) because the suppressed logs pertain to unauthenticated authentication-failure events. No user interaction is required (UI:N). There is no direct confidentiality or integrity impact on the MISP data store (VC:N, VI:N). The availability impact is Low (VA:L) because the security-logging/audit function is unavailable during the Redis outage, impairing detection and forensic capabilities, but the core MISP service remains operational. No cross-scope impacts (SC:N, SI:N, SA:N).", "draft": false, "fixSummary": "The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.", "generatedAt": "2026-09-15T09:34:28.852379Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": { "rankings": [ { "agreementScore": 9, "assumptionCount": 4, "confidence": "medium", "model": "qwen3.8:27b", "score": 6 } ], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required." }, "patchSha256": "ab1b5a5a68cf32cfb514f541d5db607932836ebf557634a44adfa822631afe9c", "patchSummary": "In app/Controller/AppController.php, the _shouldLog() method was restructured: a new early-return guard \"if (!$redis) { return true; }\" was inserted immediately after the setupRedis() call, so that an unavailable Redis connection causes all auth-failure events to be logged. The subsequent throttle check was simplified to \"if (!$redis->exists(...))\" since the null case is already handled. Additionally, a block of commented-out Redis throttle code in the afterFilter() method (lines referencing misp:auth_fail_throttling) was removed as dead code.", "patchTruncated": false, "patches": [ { "commit": "a39b25d2f141dde954a2f00feed5c6eb9e3989b5", "patchSha256": "ab1b5a5a68cf32cfb514f541d5db607932836ebf557634a44adfa822631afe9c", "source": "https://github.com/MISP/MISP/commit/a39b25d2f.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/a39b25d2f.patch", "subject": "fix: [logging] Log auth failures when the throttle cannot" } ], "source": "https://github.com/MISP/MISP/commit/a39b25d2f.patch", "subject": "fix: [logging] Log auth failures when the throttle cannot", "tagVersionBoundary": { "commits_after_fix": 189, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.46", "version": "2.5.46", "version_type": "semver" }, "weaknessRationale": [ { "cweId": "CWE-778", "rationale": "The system fails to record security-relevant events (authentication failures) when a supporting dependency (Redis) is unavailable. The logging path silently drops all audit entries under a specific operational condition, which is a textbook case of insufficient logging of security events." } ] } } }, "recordType": "advisory", "vulnId": "GCVE-1-2026-20172" } ] }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-09-15T12:00:12.607042Z", "id": "CVE-2026-92002", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T12:09:48.540Z" } } ] } }